Last updated on 13 July 2026
Privacy Policy
Zaplakso (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains how we collect, use and safeguard your information when you visit our website, book sessions, hold a membership, or contact us. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Data Controller
Zaplakso is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your information, please contact us using the details below.
2. Contact information
Email: info@zaplakso.org
Post: Zaplakso, Unit 4, Northgate House, 118 Oldham Street, Manchester M4 1LN, United Kingdom
+44 161 850 74 26
3. Personal data we collect
Depending on how you interact with us, we may collect:
Identity and contact data: name, email address, and (if you provide it) telephone number.
Membership data: membership tier, start and end dates, and payment status.
Visitor data: attendance records for sessions you book or join.
Session booking data: the sessions you reserve, dates, and any waiting-list requests.
Group booking information: names or numbers of people in a group booking you make.
Payment and transaction information: records that a payment was made, the amount and date. We do not store full card details; these are handled directly by our payment provider.
Customer service communications: the content of emails, form submissions and enquiries you send us.
Contact form data: the information you enter into our website contact form.
Technical and usage data: limited information such as IP address and browsing activity, collected via cookies where you have consented (see section 6).
4. How and why we use your data — legal bases
Under UK GDPR we rely on the following legal bases:
Performance of a contract: to process your bookings and memberships, admit you to sessions, and provide the services you’ve paid for.
Legitimate interests: to run and improve the club, manage waiting lists, respond to enquiries, keep basic attendance records, and protect the safety and good conduct of sessions. We only rely on this where your rights don’t override our interests.
Consent: for optional cookies, website analytics, and any electronic marketing communications. You may withdraw consent at any time.
Legal obligation: to keep records we’re legally required to retain (for example, certain financial records) and to comply with applicable law.
5. Membership, visitor and booking data
We use membership and booking data solely to administer your access to sessions, confirm attendance, manage capacity and waiting lists, and handle any refunds or changes. Group booking details are used only to reserve and manage those specific bookings.
6. Cookies and similar technologies
Our website uses cookies. Strictly necessary cookies, which are needed for the site to function, are set without consent as permitted under PECR. All other cookies — including preference, statistics and marketing cookies — are only set after you give consent through our cookie banner. You can change or withdraw your choices at any time via the cookie settings. Full details are in our Cookie Information section following the Terms of Service.
7. Website analytics
Where you consent, we use privacy-conscious analytics to understand how visitors use our site so we can improve it. Analytics cookies are only placed with your consent, in line with PECR.
8. Electronic marketing communications
We will only send you marketing emails (for example, news about upcoming sessions) where you have opted in, or where permitted under the limited “soft opt-in” for existing customers under PECR. Every marketing email includes an easy way to unsubscribe, and we act on unsubscribe requests promptly.
9. Data retention
We keep personal data only for as long as necessary:
Booking and attendance data: typically up to 12 months after the session.
Membership data: for the duration of your membership and up to 12 months afterwards.
Financial/transaction records: for as long as required by law (generally up to six years).
Enquiry and contact data: typically up to 12 months after your enquiry is resolved, unless a longer period is needed.
When data is no longer needed, we securely delete or anonymise it.
10. Data sharing
We do not sell your personal data. We share it only where necessary:
with our payment provider, to process payments;
with service providers who host our website or send our emails, under contract;
where required by law, or to establish, exercise or defend legal claims.
11. Service providers and processors
Any third party that processes data on our behalf does so under a written contract that requires them to protect your data and use it only as instructed, in line with UK GDPR.
12. International data transfers
We aim to keep your data within the UK. Where a service provider processes data outside the UK, we ensure appropriate safeguards are in place — such as UK adequacy regulations or the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) — so your data receives an equivalent level of protection.
13. Data security
We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. No system is completely secure, but we take reasonable steps to keep your information safe.
14. Your data subject rights
Under UK GDPR you have the right to:
be informed about how we use your data;
access the personal data we hold about you;
request correction of inaccurate data;
request erasure of your data in certain circumstances;
restrict or object to certain processing;
data portability, where applicable;
withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email info@zaplakso.org. We’ll respond within one month, as required by law.
15. Children's and minors' privacy
Our sessions and memberships are for people aged 16 and over. We do not knowingly collect data from children under 16. If you believe we hold such data, please contact us and we’ll delete it.
16. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
17. Policy updates
We may update this policy from time to time. The latest version will always be published on our website with the date of the most recent revision.
18. Complaints procedure
If you have a concern about how we handle your data, please contact us first and we’ll do our best to resolve it. You also have the right to lodge a complaint with the UK’s supervisory authority:
Information Commissioner’s Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
You can complain to the ICO at any time, though we’d welcome the chance to address your concerns directly first.